What causes "could not write json data to audit log: %s" in ffuf/ffuf?

Read the wrapped %s error to identify the OS-level cause (ENOSPC, EACCES, EBADF, etc.).

could not write json data to audit log: %s

Error message

could not write json data to audit log: %s

What it means

After successfully marshaling the audit record, Write writes the JSON bytes to the underlying audit log file. If that file Write call fails, the record is lost and this error is returned wrapping the underlying I/O error.

Source

Thrown at pkg/output/audit.go:49

	logger.lock.Lock()
	defer logger.lock.Unlock()

	d := struct {
		Type string
		Data interface{}
	}{
		reflect.TypeOf(data).String(),
		data,
	}

	j, err := json.Marshal(d)
	if err != nil {
		return fmt.Errorf("could not marshal json data: %s", err)
	}

	_, err = logger.file.Write(j)
	if err != nil {
		return fmt.Errorf("could not write json data to audit log: %s", err)
	}

	_, err = logger.file.Write([]byte("\n"))
	if err != nil {
		return fmt.Errorf("could not write newline to underlying io.Writer: %w", err)
	}

	return nil
}

View on GitHub (pinned to 33c67d28c8)

Solutions

Read the wrapped %s error to identify the OS-level cause (ENOSPC, EACCES, EBADF, etc.).
Verify the audit log file still exists, is writable, and the disk has free space (df / check quota).
Reopen or recreate the audit log file with correct permissions and retry, or point -audit-log to a different writable location.
If wrapping a custom writer, check that writer's health/connectivity before logging.

Example fix

// before
logger, _ := NewAuditLogger("/mnt/readonly/audit.json") // writes fail with EACCES
// after
logger, _ := NewAuditLogger("/var/log/ffuf/audit.json") // writable path

Defensive patterns

Strategy: try-catch

Validate before calling

if st, err := logger.file.Stat(); err != nil {
    return fmt.Errorf("audit log unavailable: %w", err)
} // plus check disk space before long runs

Try / catch

if err := logger.Write(data); err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) {
        log.Printf("audit log I/O failure (%s): reopen log", perr.Err)
        logger = reopenAuditLogger(alternatePath)
    }
    return err
}

Prevention

Monitor disk space/quota on hosts running long ffuf jobs.
Do not delete or rotate the audit log while the process holds it open; use copytruncate-style rotation.
Run with write permission on the -audit-log path; verify with a touch test first.
If using a custom io.Writer sink, wrap it with error handling/reconnect logic.

When it happens

Trigger: Calling Write when logger.file.Write(j) returns an error: the file handle is closed, the disk is full, the file was removed, permissions changed, or the underlying writer is otherwise broken.

Common situations: Disk quota/full disk on long fuzzing runs; the audit log file deleted or rotated while ffuf is running; writing to a path the process lacks write permission for; a custom io.Writer that errors (e.g. network log sink dropped).

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/cc9678f23bb25bc4. Report an issue: GitHub.